APIs
APIs expose integration logic as HTTP endpoints that external systems can invoke.
Two modes:
Builder — visual configuration with request/response mapping, routing, and transformations
Script — custom JavaScript handler function for full control
Each API gets a public URL: https://api.integrator.io/apis/{version}/{relativeURI}
API schema
Returns the APIs configured in the account, cursor-paginated via the Link header when limit is set. Legacy script-mode APIs (created before the builder/script distinction) may omit type, version, and disabled. A 204 response means nothing matched.
Maximum number of records to return per page.
100Filter to APIs whose name contains this value — a case-insensitive
substring match, not an exact match; regex metacharacters match
literally and surrounding whitespace is trimmed. An empty value is
ignored; a value longer than the maximum is rejected with 400
invalid_query_param.
OrderFilter by the disabled flag.
Opaque cursor for forward pagination. Pass the value from the Link
response header (rel="next") to fetch the next page.
Comma-separated list of fields to project into each returned record.
Triggers summary projection: the response contains a minimal identity
set (_id, name, plus resource-specific fields) with the requested
fields added on top. Supports dot notation for nested fields.
Mutually exclusive with exclude.
_integrationId,disabled,lastModifiedComma-separated list of fields to strip from the default response.
Unlike include, does not trigger summary projection — returns the
full record with the named fields removed. Protected identity fields
(e.g. name) cannot be stripped. Mutually exclusive with include.
createdAt,lastModifiedSuccessfully retrieved list of APIs.
No APIs match — the account has none, or the filters excluded every API.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
GET /v1/apis HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
[
{
"_id": "68ae4264b5f755d2dd3796b4",
"name": "Order Webhook",
"type": "builder",
"version": "v1",
"disabled": false,
"createdAt": "2025-08-26T23:25:24.107Z",
"lastModified": "2026-04-07T03:48:20.795Z"
},
{
"_id": "689212abe5118c1cabfb43b3",
"name": "Custom Handler",
"type": "script",
"version": "v1",
"disabled": false,
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest",
"createdAt": "2025-08-05T14:18:19.583Z",
"lastModified": "2025-08-05T14:18:42.626Z"
}
]Creates a new API. For script mode, include script._scriptId and script.function (the server also copies these to the top level in the response). For builder mode, builder.request can be added later — an API created without it has no route until relativeURI and method are set — but when it is present it must carry both, or the request fails with 422 invalid_api_builder_request.
Builder-mode APIs are created with logging: {"mode": "basic"} when the account license has logging enabled -- the request body cannot override this (logging is ignored on POST and PUT; change it afterwards with PATCH /v1/apis/{_id}).
Request body for creating or updating an API.
For builder-mode APIs, populate the builder object; the script field is
ignored. builder.request can be omitted on create — the API has no route
until relativeURI and method are set — but when it is present it must
carry both, or the write fails with 422 invalid_api_builder_request. For
script-mode APIs, populate script with _scriptId and function; the
builder field is ignored. On PUT, send the complete object — omitted
fields revert to defaults.
Set type explicitly to builder or script. The server infers script
when type is omitted, but new APIs must declare it.
Display name.
Customer APIIntegration this API belongs to. Builder mode only — a script-mode
API is always account-level and the server silently drops this field.
Send null (or omit) to keep the API account-level; on reads the field
is omitted when unset, never null.
5e9a8f7c6b3d2a0011c4e5f6One of the owning integration's apiGroupings, subdividing its APIs.
Requires _integrationId in the same write — sent without it, the server
silently drops both — so builder mode only. PUT /v1/apis/updateApiGrouping
regroups many APIs at once; this field carries the same value on a single
API. On reads the field is omitted when unset, never null.
60a1b2c3d4e5f60012345678Optional description of the API's purpose.
API for managing customer records in SalesforceAPI mode. Cannot be changed after creation. Defaults to script when
omitted on create; legacy script APIs created before builder mode may
omit it on reads as well.
scriptExample: builderPossible values: Version segment of the public URL (/{version}/{relativeURI}).
v1Example: v1Pattern: ^[a-zA-Z0-9\-_\.]+$When true, the API rejects all incoming requests.
falseRequest-timeout override in seconds (1–120). 0 is a sentinel meaning "use the
120-second default" — the server rewrites it on write, so a stored value is never 0.
120Handlebars template that computes each request's trace key from the request payload, used to correlate run-history entries with source records. Absent from responses until set.
{{record.orderId}}When true, this API is a draft that auto-deletes when its expiry passes
(draftExpiresAt in the response). Set at creation; an update can clear the
flag but never set it.
API created successfully
API resource. Shape varies by mode: builder-mode APIs carry type, version,
disabled, and builder; script-mode APIs additionally carry script plus
top-level _scriptId / function copies. Legacy script APIs (pre-builder era)
omit type, version, disabled, and builder entirely.
Display name.
Customer APIIntegration this API belongs to. Builder mode only — a script-mode
API is always account-level and the server silently drops this field.
Send null (or omit) to keep the API account-level; on reads the field
is omitted when unset, never null.
5e9a8f7c6b3d2a0011c4e5f6One of the owning integration's apiGroupings, subdividing its APIs.
Requires _integrationId in the same write — sent without it, the server
silently drops both — so builder mode only. PUT /v1/apis/updateApiGrouping
regroups many APIs at once; this field carries the same value on a single
API. On reads the field is omitted when unset, never null.
60a1b2c3d4e5f60012345678Optional description of the API's purpose.
API for managing customer records in SalesforceAPI mode. Cannot be changed after creation. Defaults to script when
omitted on create; legacy script APIs created before builder mode may
omit it on reads as well.
scriptExample: builderPossible values: Version segment of the public URL (/{version}/{relativeURI}).
v1Example: v1Pattern: ^[a-zA-Z0-9\-_\.]+$When true, the API rejects all incoming requests.
falseRequest-timeout override in seconds (1–120). 0 is a sentinel meaning "use the
120-second default" — the server rewrites it on write, so a stored value is never 0.
120Handlebars template that computes each request's trace key from the request payload, used to correlate run-history entries with source records. Absent from responses until set.
{{record.orderId}}When true, this API is a draft that auto-deletes when its expiry passes
(draftExpiresAt in the response). Set at creation; an update can clear the
flag but never set it.
Unique identifier for the API.
68ae4264b5f755d2dd3796b4Top-level copy of script._scriptId. Present on script-mode and legacy
script APIs for backward compatibility.
689212a2c42d988978e27a11Top-level copy of script.function. Present on script-mode and legacy
script APIs for backward compatibility.
handleRequestTimestamp when the API was created.
2025-08-26T23:25:24.107ZTimestamp when the API was last modified.
2026-04-07T03:48:20.795ZTemplate this API was created from. Present only on template-installed APIs.
60a2c4e6f321d800129a1a3cTimestamp when a draft API auto-deletes. Server-computed when draft is set at
creation.
2026-01-15T09:30:00.000ZBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
POST /v1/apis HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 118
{
"name": "Custom Handler",
"type": "script",
"script": {
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest"
}
}{
"_id": "689212abe5118c1cabfb43b3",
"name": "Custom Handler",
"type": "script",
"version": "v1",
"disabled": false,
"script": {
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest"
},
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest",
"createdAt": "2025-08-05T14:18:19.583Z",
"lastModified": "2025-08-05T14:18:19.583Z"
}Returns one invocation-counter record per resource + method + relativeURI in the current month. Counts API-style invocations across every resource type that exposes an HTTP-callable endpoint: custom APIs (builder and script), individual exports/imports called via /invoke, virtual imports, and APIM-fronted invocations.
The endpoint aggregates -- it does not return one record per individual call. Each entry rolls up every invocation of that (resource, method, URI) triple in the current month. Counters reset on the 1st of each month; there is no pagination and no historical-months filter on this path. For month-over-month account totals use GET /v1/apis/usage/summary; for the current month split by environment use GET /v1/apis/usage/environments.
ioInvocationCount bills against the Celigo subscription; apimInvocationCount is billed separately for external APIM passthrough. To find the resource behind a row, read metadata._resourceId (present for exports/imports) or parse the resource id out of relativeURI.
Comma-separated list of fields to project into each returned record.
Triggers summary projection: the response contains a minimal identity
set (_id, name, plus resource-specific fields) with the requested
fields added on top. Supports dot notation for nested fields.
Mutually exclusive with exclude.
_integrationId,disabled,lastModifiedComma-separated list of fields to strip from the default response.
Unlike include, does not trigger summary projection — returns the
full record with the named fields removed. Protected identity fields
(e.g. name) cannot be stripped. Mutually exclusive with include.
createdAt,lastModifiedUsage breakdown for the current month. usages[] is empty when no endpoints have been invoked yet.
Month-to-date invocation counters for every API endpoint that has been called in the account.
Returned by GET /v1/apis/usage. Each entry in usages[] represents one resource + method +
relativeURI triple — the same export or import invoked via two different methods yields two
entries. Counters are cumulative for the month named in month / year and reset on the 1st.
Account-wide count of invocations that arrived through an external API Management layer
(APIM) in front of integrator.io for the current month. Aggregate counterpart to the
per-endpoint apimInvocationCount values in usages[]. Absent on some responses when the
account has never been routed through an external APIM.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
GET /v1/apis/usage HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"usages": [
{
"_id": "69d054b9be4ce14fb4112827",
"method": "POST",
"relativeURI": "/v1/exports/6878f4a43bc01652c09cdccc/invoke",
"metadata": {
"_resourceId": "6878f4a43bc01652c09cdccc",
"name": "Get Contacts",
"type": "export"
},
"month": 4,
"year": 2026,
"ioInvocationCount": 29,
"apimInvocationCount": 0,
"createdAt": "2026-04-04T00:00:57.285Z"
}
]
}Returns one total per calendar month, newest first, summed across every environment in the account, alongside the invocations the subscription allowed for that month. Use it for trend and overage reporting; GET /v1/apis/usage gives the per-endpoint breakdown for the current month only.
Without from/to the response covers the current month and the thirteen before it. Both parameters take YYYY/MM; the window is capped at fourteen months, to may not be in the future, and from may not precede the fourteen-month lookback. A malformed or out-of-range value is not rejected — the server silently falls back to the default window, so check the year/month of the first and last entries when passing a range.
First month to include, as YYYY/MM. Defaults to thirteen months before the current month.
2026/07Pattern: ^[0-9]{4}/(0?[1-9]|1[0-2])$Last month to include, as YYYY/MM. Defaults to the current month.
2026/09Pattern: ^[0-9]{4}/(0?[1-9]|1[0-2])$Monthly totals, newest month first. Months without traffic are included with "0" counts.
Account-wide API invocation total for one calendar month, summed across every environment. Counts are serialized as decimal strings.
Four-digit year the total covers.
2026Calendar month (1 = January) the total covers.
9Invocations recorded in the month across all environments — integrator.io
front-door calls plus calls that arrived through an external API Management
layer — as a decimal string. "0" for months with no traffic.
5853Pattern: ^[0-9]+$Invocations the subscription allowed for that month (base plus add-on), as a
decimal string. Compare with invocationCount to spot overage months. "0"
when the license carries no API invocation entitlement.
100000Pattern: ^[0-9]+$Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
GET /v1/apis/usage/summary HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
[
{
"year": 2026,
"month": 9,
"invocationCount": "5853",
"entitlements": "100000"
},
{
"year": 2026,
"month": 8,
"invocationCount": "155",
"entitlements": "100000"
},
{
"year": 2026,
"month": 7,
"invocationCount": "77",
"entitlements": "100000"
}
]Returns the current month's invocation counters for every environment in the account, including environments with no traffic. Counters reset on the first of each month. GET /v1/apis/usage returns the per-endpoint breakdown for the calling environment only; use this operation to compare environments side by side.
Per-environment counters for the current month.
Current-month API invocation totals broken down by environment, as returned by
GET /v1/apis/usage/environments.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
GET /v1/apis/usage/environments HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"usage": [
{
"environment": {
"_id": "68f76c67f7876d161ffb9c52",
"name": "Production"
},
"ioInvocationCount": 5853,
"apimInvocationCount": 0,
"externalApimCount": 0
},
{
"environment": {
"_id": "69150a05578417f9fa40dbe4",
"name": "Sandbox"
},
"ioInvocationCount": 0,
"apimInvocationCount": 0,
"externalApimCount": 0
}
]
}Returns the complete configuration of a specific API.
The unique identifier of the API
5f8d43a1b9e5a80011a35f2cAPI retrieved successfully.
API resource. Shape varies by mode: builder-mode APIs carry type, version,
disabled, and builder; script-mode APIs additionally carry script plus
top-level _scriptId / function copies. Legacy script APIs (pre-builder era)
omit type, version, disabled, and builder entirely.
Display name.
Customer APIIntegration this API belongs to. Builder mode only — a script-mode
API is always account-level and the server silently drops this field.
Send null (or omit) to keep the API account-level; on reads the field
is omitted when unset, never null.
5e9a8f7c6b3d2a0011c4e5f6One of the owning integration's apiGroupings, subdividing its APIs.
Requires _integrationId in the same write — sent without it, the server
silently drops both — so builder mode only. PUT /v1/apis/updateApiGrouping
regroups many APIs at once; this field carries the same value on a single
API. On reads the field is omitted when unset, never null.
60a1b2c3d4e5f60012345678Optional description of the API's purpose.
API for managing customer records in SalesforceAPI mode. Cannot be changed after creation. Defaults to script when
omitted on create; legacy script APIs created before builder mode may
omit it on reads as well.
scriptExample: builderPossible values: Version segment of the public URL (/{version}/{relativeURI}).
v1Example: v1Pattern: ^[a-zA-Z0-9\-_\.]+$When true, the API rejects all incoming requests.
falseRequest-timeout override in seconds (1–120). 0 is a sentinel meaning "use the
120-second default" — the server rewrites it on write, so a stored value is never 0.
120Handlebars template that computes each request's trace key from the request payload, used to correlate run-history entries with source records. Absent from responses until set.
{{record.orderId}}When true, this API is a draft that auto-deletes when its expiry passes
(draftExpiresAt in the response). Set at creation; an update can clear the
flag but never set it.
Unique identifier for the API.
68ae4264b5f755d2dd3796b4Top-level copy of script._scriptId. Present on script-mode and legacy
script APIs for backward compatibility.
689212a2c42d988978e27a11Top-level copy of script.function. Present on script-mode and legacy
script APIs for backward compatibility.
handleRequestTimestamp when the API was created.
2025-08-26T23:25:24.107ZTimestamp when the API was last modified.
2026-04-07T03:48:20.795ZTemplate this API was created from. Present only on template-installed APIs.
60a2c4e6f321d800129a1a3cTimestamp when a draft API auto-deletes. Server-computed when draft is set at
creation.
2026-01-15T09:30:00.000ZUnauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"_id": "689212abe5118c1cabfb43b3",
"name": "Custom Handler",
"type": "script",
"version": "v1",
"disabled": false,
"script": {
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest"
},
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest",
"createdAt": "2025-08-05T14:18:19.583Z",
"lastModified": "2025-08-05T14:18:42.626Z"
}Replaces the full API configuration. Send the complete object -- omitted fields revert to defaults, not their prior values. Read-only fields (_id, createdAt, lastModified) in the request body are ignored.
logging is also ignored -- silently: a PUT that includes logging succeeds with the stored value unchanged, and no error reveals that the change was dropped. Use PATCH /v1/apis/{_id} (paths /logging/mode, /logging/debugUntil) to change logging settings.
Always send disabled: false on a builder-mode PUT: a body that omits it leaves the flag unset, and the public endpoint answers 404 api_not_found until a PUT sets it again.
The unique identifier of the API
5f8d43a1b9e5a80011a35f2cRequest body for creating or updating an API.
For builder-mode APIs, populate the builder object; the script field is
ignored. builder.request can be omitted on create — the API has no route
until relativeURI and method are set — but when it is present it must
carry both, or the write fails with 422 invalid_api_builder_request. For
script-mode APIs, populate script with _scriptId and function; the
builder field is ignored. On PUT, send the complete object — omitted
fields revert to defaults.
Set type explicitly to builder or script. The server infers script
when type is omitted, but new APIs must declare it.
Display name.
Customer APIIntegration this API belongs to. Builder mode only — a script-mode
API is always account-level and the server silently drops this field.
Send null (or omit) to keep the API account-level; on reads the field
is omitted when unset, never null.
5e9a8f7c6b3d2a0011c4e5f6One of the owning integration's apiGroupings, subdividing its APIs.
Requires _integrationId in the same write — sent without it, the server
silently drops both — so builder mode only. PUT /v1/apis/updateApiGrouping
regroups many APIs at once; this field carries the same value on a single
API. On reads the field is omitted when unset, never null.
60a1b2c3d4e5f60012345678Optional description of the API's purpose.
API for managing customer records in SalesforceAPI mode. Cannot be changed after creation. Defaults to script when
omitted on create; legacy script APIs created before builder mode may
omit it on reads as well.
scriptExample: builderPossible values: Version segment of the public URL (/{version}/{relativeURI}).
v1Example: v1Pattern: ^[a-zA-Z0-9\-_\.]+$When true, the API rejects all incoming requests.
falseRequest-timeout override in seconds (1–120). 0 is a sentinel meaning "use the
120-second default" — the server rewrites it on write, so a stored value is never 0.
120Handlebars template that computes each request's trace key from the request payload, used to correlate run-history entries with source records. Absent from responses until set.
{{record.orderId}}When true, this API is a draft that auto-deletes when its expiry passes
(draftExpiresAt in the response). Set at creation; an update can clear the
flag but never set it.
API updated successfully
API resource. Shape varies by mode: builder-mode APIs carry type, version,
disabled, and builder; script-mode APIs additionally carry script plus
top-level _scriptId / function copies. Legacy script APIs (pre-builder era)
omit type, version, disabled, and builder entirely.
Display name.
Customer APIIntegration this API belongs to. Builder mode only — a script-mode
API is always account-level and the server silently drops this field.
Send null (or omit) to keep the API account-level; on reads the field
is omitted when unset, never null.
5e9a8f7c6b3d2a0011c4e5f6One of the owning integration's apiGroupings, subdividing its APIs.
Requires _integrationId in the same write — sent without it, the server
silently drops both — so builder mode only. PUT /v1/apis/updateApiGrouping
regroups many APIs at once; this field carries the same value on a single
API. On reads the field is omitted when unset, never null.
60a1b2c3d4e5f60012345678Optional description of the API's purpose.
API for managing customer records in SalesforceAPI mode. Cannot be changed after creation. Defaults to script when
omitted on create; legacy script APIs created before builder mode may
omit it on reads as well.
scriptExample: builderPossible values: Version segment of the public URL (/{version}/{relativeURI}).
v1Example: v1Pattern: ^[a-zA-Z0-9\-_\.]+$When true, the API rejects all incoming requests.
falseRequest-timeout override in seconds (1–120). 0 is a sentinel meaning "use the
120-second default" — the server rewrites it on write, so a stored value is never 0.
120Handlebars template that computes each request's trace key from the request payload, used to correlate run-history entries with source records. Absent from responses until set.
{{record.orderId}}When true, this API is a draft that auto-deletes when its expiry passes
(draftExpiresAt in the response). Set at creation; an update can clear the
flag but never set it.
Unique identifier for the API.
68ae4264b5f755d2dd3796b4Top-level copy of script._scriptId. Present on script-mode and legacy
script APIs for backward compatibility.
689212a2c42d988978e27a11Top-level copy of script.function. Present on script-mode and legacy
script APIs for backward compatibility.
handleRequestTimestamp when the API was created.
2025-08-26T23:25:24.107ZTimestamp when the API was last modified.
2026-04-07T03:48:20.795ZTemplate this API was created from. Present only on template-installed APIs.
60a2c4e6f321d800129a1a3cTimestamp when a draft API auto-deletes. Server-computed when draft is set at
creation.
2026-01-15T09:30:00.000ZBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PUT /v1/apis/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 121
{
"name": "Custom Handler v2",
"type": "script",
"script": {
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest"
}
}{
"_id": "689212abe5118c1cabfb43b3",
"name": "Custom Handler v2",
"type": "script",
"version": "v1",
"disabled": false,
"script": {
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest"
},
"_scriptId": "689212a2c42d988978e27a11",
"function": "handleRequest",
"createdAt": "2025-08-05T14:18:19.583Z",
"lastModified": "2025-08-05T14:18:42.626Z"
}Deletes an API. Soft-deleted and retained in the recycle bin for 30 days. The public endpoint stops responding immediately. The delete succeeds even with dependents, but those resources will break -- check GET /v1/apis/{_id}/dependencies first.
The unique identifier of the API
5f8d43a1b9e5a80011a35f2cAPI deleted successfully
No content
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
DELETE /v1/apis/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
No content
Partially updates an API using a JSON Patch document (RFC 6902). The replace operation is supported on the following whitelisted paths (/logging/debugUntil also accepts remove, which clears an active debug window early):
/name
API display name
/description
API description
/disabled
Enable or disable the API (boolean)
/timeoutPeriod
Request-timeout override in seconds
/pagination/enabled
Enable or disable cursor pagination (boolean; builder-mode only — a script-mode API fails with 422 code api_pagination_builder_only, and enabling re-runs the volume-driver checks described on pagination.enabled)
/logging/mode
Logging level for requests handled by this API
/logging/debugUntil
End of a temporary full-debug capture window
/traceKeyTemplate
Handlebars template that computes each request's trace key
All other paths are rejected with 422. This is the only way to change logging -- PUT silently ignores that field.
Logging changes are validated against account entitlements: setting /logging/mode to a payload-capturing mode (standard, detailed) fails with 422 (code payload_storage_required) when the account does not have payload storage enabled, and /logging/debugUntil has the same payload-storage requirement. Accounts whose license does not include logging, or whose license caps the maximum logging mode below the requested one, are also rejected with 422.
The unique identifier of the API
5f8d43a1b9e5a80011a35f2cA JSON Patch document (RFC 6902). Send an array of patch operations on whitelisted fields — all other paths are rejected with 422.
The operation to perform.
JSON Pointer (RFC 6901) to the field to patch. Only
whitelisted paths are accepted — unlisted paths return
422 with "<path> is not a whitelisted property".
The new value to set. Required for replace and add, omit for remove.
API patched successfully
No content
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PATCH /v1/apis/{_id} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 50
[
{
"op": "replace",
"path": "/disabled",
"value": true
}
]No content
Accepts a sample JSON object and returns its inferred JSON Schema definition. Useful for bootstrapping bodySchema in builder-mode APIs from real payload samples. Input must be a non-empty JSON object -- arrays and primitives are rejected. The generated schema is shallow (one level of properties); nested objects become type: "object" without further property inference.
Any sample JSON object to convert into JSON Schema.
JSON Schema generated successfully.
objectBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PUT /v1/apis/schema HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 45
{
"name": "Acme Corp",
"active": true,
"count": 42
}{
"type": "object",
"properties": {
"name": {
"type": "string"
},
"active": {
"type": "boolean"
},
"count": {
"type": "number"
}
}
}Assigns or removes an API grouping for the specified API resources. Pass _apiGroupingId: null or omit it to ungroup. Nonexistent API IDs are silently accepted.
Every API in _apiIds must belong to the same integration, and the grouping must be one of that integration's apiGroupings. Each API is re-saved through full validation, so an API that cannot be saved as it stands (for example a builder API whose response router is not configured yet) fails the request with 400 apigrouping_update_error; regroup such an API with a full PUT /v1/apis/{_id} instead.
List of API resource IDs to update.
The grouping ID to assign. Pass null or omit to remove the
current grouping from the specified APIs.
60a1b2c3d4e5f60012345678API grouping updated successfully (no body returned).
No content
The request was rejected: the APIs span more than one integration
(invalid_request), or one API could not be re-saved with the new grouping
(apigrouping_update_error — the grouping belongs to another integration, or the
API fails its own validation).
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
PUT /v1/apis/updateApiGrouping HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 111
{
"_apiIds": [
"5f8d43a1b9e5a80011a35f2c",
"5f8d43a1b9e5a80011a35f2d"
],
"_apiGroupingId": "60a1b2c3d4e5f60012345678"
}No content
Returns the recent invocation traces captured for the named API. Each entry is a decoded request/response pair — masked for credentials — that the runtime stored when the API was called via its public endpoint. Use this to audit what the API has handled and to triage errors without re-invoking the API.
Traces are file-backed with server-controlled retention and capture scope; an empty requests[] simply means nothing is currently stored for this API. Two invocation sources do not populate this log:
Test-runs via
POST /v1/apis/{_id}/test/runnever surface here.Script-mode API invocations via
POST /v1/apis/{_id}/requestalso do not surface here despite counting toward/v1/apis/usage. Only builder-mode invocations against the public endpoint (https://api.integrator.io/apis/{version}{relativeURI}) populate logs.
List entries are summaries (key, time, method, statusCode) — to see the decoded request/response payload, follow up with GET /v1/apis/{_id}/logs/{key}.
statusCode is returned as a string in list entries but as an integer on the detail endpoint. Credential values are masked as ******** before storage and are not recoverable.
The API id.
68ae4264b5f755d2dd3796b4Trace envelope. requests[] is empty when no invocations are currently stored.
Request log envelope returned by GET /v1/apis/{_id}/logs. Contains the recent API invocation
traces for the API identified by _id. The requests[] array is empty when no invocations
have been logged — either the API has never been called, or debug capture is off, or the
retention window has elapsed. Each entry is a full decoded request/response pair.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id}/logs HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"requests": []
}Returns the full decoded request/response envelope for one API invocation, looked up by the opaque key values surfaced in GET /v1/apis/{_id}/logs. Matches the exact entry whose key is provided — there is no partial-match or range query on this endpoint.
Unlike the parent list (which only carries {key, time, method, statusCode}), this endpoint returns the complete payload: request method/url/headers/body/queryParams/clientAddress, response status/headers/body/responseTime, and (for builder-mode APIs) the inputToResponseBubble snapshot of what the response-mapper saw. Sensitive header values (authorization, OAuth bearer tokens) are masked as ******** before storage.
For builder APIs where the response mapper didn't produce the expected output, inspect inputToResponseBubble.sourceRecord to see what the response stage actually received. response.statusCode is an integer here but the sibling list endpoint returns it as a string. A 404 file_not_found means the key has expired from retention or was never captured.
The API id.
68ae4264b5f755d2dd3796b4Opaque log key from the parent GET /v1/apis/{_id}/logs listing. Encodes status + method
(e.g. …-200-POST) — use the key exactly as returned; do not construct one manually.
5481201053696-a10af1ade8fe477a847771c1e3716e36-200-POSTThe decoded request/response envelope.
Full decoded request/response envelope for one API invocation, returned by
GET /v1/apis/{_id}/logs/{key}. Sensitive header values (authorization, OAuth bearer tokens,
and similar) are masked with ******** before storage — the originals are not recoverable.
The inputToResponseBubble block reveals the Celigo-internal state handed to the
response-mapping stage; it's absent for script-mode APIs and pre-mapping failures.
Epoch milliseconds when the invocation was handled.
1776917346304Echoes the key path parameter. Same structure as in the list (<seq>-<id>-<status>-<method>).
5481201053696-a10af1ade8fe477a847771c1e3716e36-200-POSTShorter internal id for this log record. Appears embedded in the key string as the second
segment. Not independently useful to the caller, but handy for correlating with audit or
monitoring logs that reference only the short id.
a10af1ade8fe477a847771c1e3716e36Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id}/logs/{key} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"time": 1776917346304,
"request": {
"method": "POST",
"url": "/apis/v1/orders",
"httpVersion": "1.1",
"headers": {
"content-type": "application/json",
"authorization": "********",
"accept": "application/json",
"host": "api.integrator.io"
},
"queryParams": {},
"body": "{\"orderId\":\"SO-1042\",\"total\":129.99}",
"clientAddress": "::ffff:127.0.0.6",
"size": 0
},
"response": {
"statusCode": 200,
"statusMessage": "OK",
"headers": {
"content-type": "application/json",
"x-request-id": "abc123def456"
},
"body": "{\"orderId\":\"SO-1042\"}",
"size": 21,
"responseTime": 312
},
"inputToResponseBubble": {
"sourceRecord": [
{
"orderId": "SO-1042",
"total": 129.99
}
],
"executionErrors": [],
"configurationErrors": []
},
"key": "5481201053696-a10af1ade8fe477a847771c1e3716e36-200-POST",
"id": "a10af1ade8fe477a847771c1e3716e36"
}Returns the logged request executions of a builder-mode API — one entry per inbound request to its public endpoint captured while the API's logging.mode was anything other than noLogging, including requests that failed before reaching a response step. Distinct from GET /v1/apis/{_id}/logs, which returns the legacy file-backed request/response envelopes: use /requests for run history and trace drill-down, /logs for the raw decoded request and response of a single call.
Run history exists only for builder-mode APIs — a script-mode API id returns 404 invalid_ref ("api not found."), the same as an unknown id.
Results are cursor-paginated (next/prev). When time_gte / time_lte are omitted, only the last 5 minutes are returned — pass an explicit window for a broader history. Use the executionId from a list entry with GET /v1/apis/{_id}/requests/{executionId} to open the trace view.
The API id.
685021eda02a61042cee80abFilter by HTTP response status code — a single value or a comma-separated list. Every value must be an integer.
200,404Pattern: ^\d+(,\d+)*$Filter by HTTP method (case-insensitive; normalized to uppercase).
GETPossible values: Prefix filter on the request trace key.
trace-abcPrefix filter on the client IP address.
192.168.1.Prefix filter on the request relative URI.
/ordersFree-text search, OR-matched across traceKey (prefix), remoteIP
(prefix), and relativeURI (substring). When provided, the individual
traceKey/remoteIP/relativeURI filters are ignored. Values shorter
than 3 characters are rejected with 400.
order-123Number of entries per page. Values above the documented maximum are not rejected — the server accepts them silently, so treat the maximum as the supported contract rather than an enforced limit.
50Example: 50Sort direction by request time.
descPossible values: ISO 8601 timestamp cursor for the next page (from nextPageUrl).
Mutually exclusive with prev; requires cursorExecutionId.
ISO 8601 timestamp cursor for the previous page (from prevPageUrl).
Mutually exclusive with next; requires cursorExecutionId.
Tie-breaker execution id, required when paging with next/prev.
Include requests at or after this ISO timestamp.
Include requests at or before this ISO timestamp.
Paginated run history. requests[] is empty when nothing matches.
Paginated API request run history.
URL to fetch the next page (carries the next cursor and
cursorExecutionId tie-breaker); null when there is no next page.
https://api.integrator.io/v1/apis/685021eda02a61042cee80ab/requests?pageSize=50&next=2026-05-15T13:42:11.234Z&cursorExecutionId=a1b2c3d4e5f678901234URL to fetch the previous page; null when there is no previous page.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id}/requests HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"requests": [
{
"executionId": "a1b2c3d4e5f678901234",
"time": "2026-05-15T13:42:11.234000Z",
"method": "POST",
"relativeURI": "/apis/v1/orders",
"statusCode": 200,
"traceKey": "trace-abc-123",
"remoteIP": "192.168.1.5",
"timeTaken": 142,
"logMode": "detailed"
},
{
"executionId": "b7c8d9e0f1a2b3c4d5e6",
"time": "2026-05-15T13:41:58.012000Z",
"method": "POST",
"relativeURI": "/apis/v1/orders",
"statusCode": 422,
"traceKey": "",
"remoteIP": "192.168.1.5",
"timeTaken": 925,
"logMode": "basic"
}
],
"nextPageUrl": null,
"prevPageUrl": null
}Queues asynchronous deletion of stored request log payloads for the API within [startedAt, endAt]. Returns 202 Accepted; cleanup runs in the background. Requires manage access for log deletion — monitor-level users receive 403.
The API id.
685021eda02a61042cee80abStart of the deletion range, inclusive (ISO 8601). Must be before endAt.
2026-01-01T00:00:00.000ZEnd of the deletion range, inclusive (ISO 8601). Must not be in the future.
2026-01-31T23:59:59.999ZDeletion request accepted for asynchronous processing.
No content
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
DELETE /v1/apis/{_id}/requests?startedAt=2026-01-01T00%3A00%3A00.000Z&endAt=2026-01-31T23%3A59%3A59.999Z HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
No content
Returns the top-level execution steps for the trace view of one API request, in execution order: the request-parsing step (identified by the API's own id; omitted for requests logged in basic mode), one step per export or import the request passed through, and the response step (identified by the response id, such as success). A request that failed mid-way lists only the steps that ran. Per-step payloads are fetched separately with the log-data query endpoint.
An unknown executionId returns 200 with an empty steps array; a malformed one returns 422 (invalid_execution_id). An unknown or script-mode API _id returns 404.
The API id.
685021eda02a61042cee80abThe execution id (20-character lowercase hex).
a1b2c3d4e5f678901234Pattern: ^[0-9a-f]{20}$Top-level trace steps for the request execution.
Top-level execution steps for the trace view of an API request.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
GET /v1/apis/{_id}/requests/{executionId} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"steps": [
{
"_expOrImpId": "685021eda02a61042cee80ab",
"status": "success",
"timeTaken": 28,
"groupId": "P5sHHN",
"recordId": "IBStzj0l",
"parentRecordId": "",
"time": "2026-05-15T13:42:11.234000Z"
},
{
"_expOrImpId": "67ee026136f4d1eeb529ad63",
"status": "success",
"timeTaken": 167,
"groupId": "BmTULYT1",
"recordId": "hGikWbfA",
"parentRecordId": "",
"time": "2026-05-15T13:42:11.446000Z"
},
{
"_expOrImpId": "success",
"status": "success",
"timeTaken": 74,
"groupId": "70ffxC",
"recordId": "5tPoPe",
"parentRecordId": "",
"time": "2026-05-15T13:42:11.566000Z"
}
]
}List child records under an API trace step
Returns the child records under a parent record within an API request trace (lookup / one-to-many expansions). Results are cursor-paginated (next/prev).
The API id.
685021eda02a61042cee80abThe execution id (20-character lowercase hex).
a1b2c3d4e5f678901234Pattern: ^[0-9a-f]{20}$Export or import id of the step, or <toolId>_input / <toolId>_output
for a nested Tool step's boundary. Response-step ids such as success
have no child records and are rejected with 400.
67ee026136f4d1eeb529ad63Pattern: ^[0-9a-fA-F]{24}(_(input|output))?$The parent record id whose children are returned.
a1b2c3Filter children by processing outcome — a single value or a
comma-separated list of success, error, ignore.
success,errorPattern: ^(success|error|ignore)(,(success|error|ignore))*$Number of entries per page.
50Example: 50Sort direction by step time.
descPossible values: ISO 8601 timestamp cursor for the next page (from nextPageUrl).
Mutually exclusive with prev; requires cursorRecordId.
ISO 8601 timestamp cursor for the previous page (from prevPageUrl).
Mutually exclusive with next; requires cursorRecordId.
Tie-breaker record id, required when paging with next/prev.
Paginated child step records.
Paginated child records under a parent record in an API request trace.
URL to fetch the next page; null when there is no next page.
URL to fetch the previous page; null when there is no previous page.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
GET /v1/apis/{_id}/requests/{executionId}/{_expOrImpId}/logs/{parentRecordId}/children HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"children": [
{
"_expOrImpId": "67ee026136f4d1eeb529ad63",
"status": "success",
"timeTaken": 12,
"groupId": "6449f2",
"recordId": "child-1",
"parentRecordId": "a1b2c3",
"time": "2026-05-15T13:42:11.234Z"
}
],
"nextPageUrl": null,
"prevPageUrl": null
}Query decoded log data for an API trace step
Returns the decoded request/response payload and error metadata for a record/stage within an API request execution, identified by _expOrImpId, stage, groupId, and recordId. If the log content exceeds inline limits or is stored externally, an externalReference with an S3 key (and optional byte range) is returned — download it via the signed-URL endpoint. The response may be gzip-compressed.
The API id.
685021eda02a61042cee80abThe execution id (20-character lowercase hex).
a1b2c3d4e5f678901234Pattern: ^[0-9a-f]{20}$Query payload for retrieving decoded log data for a step within an API request execution. Same shape as the flow log-data query.
Step to read: the export or import id, an eleven-character builder
resource-step identifier, or <toolId>_input / <toolId>_output for a
nested Tool step's boundary. Any other value is rejected with 400
invalid_exp_or_imp_id.
67ee026136f4d1eeb529ad63Pattern: ^([0-9a-fA-F]{24}(_(input|output))?|[0-9A-Za-z]{11})$Processing stage to fetch data for.
mappingGroup identifier for the step's records.
grp-001Identifier of the record to fetch.
rec-123Log data (and/or external references) plus error metadata.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
POST /v1/apis/{_id}/requests/{executionId}/logs/data/query HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 101
{
"_expOrImpId": "67ee026136f4d1eeb529ad63",
"stage": "mapping",
"groupId": "grp-001",
"recordId": "rec-123"
}{
"logs": [],
"errors": []
}Get a signed URL for a stored API request log payload
Returns a short-lived signed S3 URL (five-minute expiry) for the provided s3Key suffix, taken from an externalReference returned by the log-data query endpoint. The full S3 key is resolved under the execution's own log prefix, so callers can only access logs for this API and execution; the key is not checked for existence, so a mistyped suffix still yields a URL that fails on download.
The API id.
685021eda02a61042cee80abThe execution id (20-character lowercase hex).
a1b2c3d4e5f678901234Pattern: ^[0-9a-f]{20}$S3 object key suffix relative to the execution's log prefix, typically
returned in a prior log-data query externalReference.
67ee026136f4d1eeb529ad63/grp-001/part.logSigned URL for the requested object.
A short-lived signed URL for downloading a stored API request log payload object.
Time-limited signed URL (five minutes) to download the referenced log object.
https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/api-execution-logs/user/api/exec/group/file.log?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=300&X-Amz-Signature=...Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Forbidden. The authenticated caller does not have permission to perform this operation.
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
GET /v1/apis/{_id}/requests/{executionId}/logs/signedURL?s3Key=67ee026136f4d1eeb529ad63%2Fgrp-001%2Fpart.log HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"signedURL": "https://integrator-userdata-delete-30.s3.amazonaws.com/api-execution-logs/user/api/exec/group/file.log?Expires=1754046196&Signature=..."
}Returns the set of resources that depend on the specified resource. The response is an object whose keys are dependent-resource types (e.g. flows, imports) and whose values are arrays of dependency entries. An empty object {} means no other resources depend on the target -- this is also returned for a well-formatted but nonexistent id.
Resource ID.
5f8d43a1b9e5a80011a35f2cDependency map. Keys are resource-type strings; values are arrays
of dependency entries. Returns {} when no dependents exist.
Map of dependent-resource types to arrays of dependency entries.
Keys are plural resource type strings (e.g. flows, imports,
connections). An empty object {} means no dependents.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
GET /v1/apis/{_id}/dependencies HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{}Returns the connections referenced by the export and import steps in builder.routers, including connections a nested Tool step supplies through its overrides. Each connection appears once even when several steps share it. Use this to see which systems an API talks to before cloning it or calling PUT /v1/apis/{_id}/replaceConnection.
Callers with manage access to the API's integration receive full Connection objects; callers with monitor-only access receive a reduced representation (_id, name, description, type, and the connector or database type under the adaptor key) without endpoint or credential fields. Script-mode APIs have no steps and return an empty array.
API id.
6ab1f5257b3d01a908424245Connections referenced by the API's steps. Empty array when the API has no steps or none of them use a connection.
Connection object as returned by the API.
Unique identifier for the resource. Format is a 24-character hexadecimal string.
5f8d43a1b9e5a80011a35f2cTimestamp when the resource was created. Set automatically and cannot be modified.
2023-04-01T09:15:32ZTimestamp when the resource was last updated. Changes whenever any property is modified.
2023-04-15T14:30:15ZTimestamp when the resource was soft-deleted. When null or absent, the resource is active.
2023-05-20T11:45:32ZReference to the specific integration instance that contains this resource.
This field is only populated for resources that are part of an integration app installation. It contains the unique identifier (_id) of the integration resource that was installed in the account.
The integration instance represents a specific installed instance of an integration app, with its own configuration, settings, and runtime environment.
This reference enables:
- Tracing the resource back to its parent integration instance
- Permission and access control based on integration ownership
- Lifecycle management (enabling/disabling, updating, or uninstalling)
5f9a7b2c3d4e5f6a7b8c9d0eReference to the integration app that defines this resource.
This field is only populated for resources that are part of an integration app. It contains the unique identifier (_id) of the integration app (connector) that defines the structure, behavior, and templates for this resource.
The integration app is the published template that can be installed multiple times across different accounts, with each installation creating a separate integration instance (referenced by _integrationId).
This reference enables:
- Identifying the source integration app for this resource
- Determining which template version is being used
- Linking to documentation, support, and marketplace information
5e8d43a1b9e5a80011a35f1bDisplay name for the connection.
Salesforce ProductionThe type of connection determining which authentication and connectivity options are available
External identifier for the connection, often used for integration with third-party systems
erp-conn-001Application name in lowercase for HTTP connections to systems with integrator.io adaptors. Used to identify the target application being connected to. Examples - Shopify: "shopify", eBay: "ebay". Only applicable for HTTP connection types.
shopifyReference to a Celigo on-premise Agent. Required for connection types that need local network or filesystem access (JDBC, filesystem, Oracle RDBMS, and on-premise MongoDB). The agent establishes a secure tunnel between the on-premise environment and integrator.io.
5f8d43a1b9e5a80011a35f2cReference to another connection to share concurrency limits with. When set, this connection's traffic counts against the referenced connection's limit instead of its own, and its own concurrency and auto-recovery settings have no effect. One level only: the referenced connection may not itself borrow, and a connection that others borrow from cannot start borrowing.
615dfa0742763671275b70abDate until which debug logging is enabled for this connection
2026-01-15T09:30:00.000ZDynamic form configuration for connection-specific settings
Connection-specific settings and configurations
When true, the connection has been taken offline and is skipped during flow execution.
Source connection this was cloned from.
5f29dbc69e8a0f0e29a491b7Distinguishes account-owned connections from the per-end-user credential copies
MCP servers collect. Absent on connections last saved before the field existed,
which behave as standard. Sending mcpChild on POST or PUT /v1/connections
fails with 422 mcp_child_generic_route_not_allowed, and /connectionRole is not a
patchable path; child connections are written only by the MCP end-user setup page,
never through /v1.
standardPossible values: Dot-paths of this connection's fields (for example http.encrypted.apiKey or
rdbms.user) that each MCP end user must supply on their own mcpChild copy instead
of inheriting the parent's value. Only returned on a standard connection that has
paths set; never returned on a child. Writable through POST, PUT, and PATCH;
by the platform contract, a write that changes the list invalidates the children end
users already hold against this parent.
["http.encrypted.apiKey","http.unencrypted.accountId"]Parent connection this child copies its non-credential configuration from. Present
only when connectionRole is mcpChild; set by the end-user setup page and ignored
when sent on a standard connection.
615dfa0742763671275b70abAccount owner whose parent connection and MCP servers this child belongs to. Present
only when connectionRole is mcpChild; on a child, _userId is the end user and
this field is the account.
5d2e1f0a9b8c7d6e5f4a3b2cTimestamp when the child's non-credential fields were last synced from the parent
connection. Present only when connectionRole is mcpChild.
2026-09-15T18:42:10.331ZEnd user who owns this mcpChild connection's credentials. Present only when
connectionRole is mcpChild; a standard connection belongs to the account and
omits this field.
5d2e1f0a9b8c7d6e5f4a3b2cDebug logging is active until this timestamp. Absent or in the past means debug is off.
2026-01-15T09:30:00.000ZMasked placeholder for encrypted credential fields. Always returns "******".
When true, the connection uses the HTTP adaptor internally, even when type is wrapper.
When true, rate-limit errors from the target system trigger automatic recovery: concurrency
drops to 1, the rate-limited requests are retried with doubling waits (1 to 1024 minutes,
after which the flag switches itself off), and concurrency climbs back toward
targetConcurrencyLevel. While true, targetConcurrencyLevel is the throughput lever: a
concurrencyLevel sent in a PUT is ignored, and one sent in a PATCH is stored but the
recovery machinery moves it back toward the target.
trueWhen true, enables micro-batching for one-to-many data flows through this connection.
trueWhen true, enables CSV-to-object parsing for data received through this connection.
trueBad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id}/connections HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
[
{
"_id": "6ab1f50179bf70c118711501",
"name": "Product catalog (prod)",
"type": "http",
"connectionRole": "standard",
"http": {
"formType": "http",
"mediaType": "json",
"baseURI": "https://catalog.example.com",
"concurrencyLevel": 25,
"auth": {
"type": "custom"
}
},
"createdAt": "2026-09-22T03:24:49.356Z",
"lastModified": "2026-09-22T03:24:49.715Z"
}
]Repoints every export and import step in builder.routers that uses _connectionId to _newConnectionId, saving each step resource in place, and returns how many steps changed. Use it instead of per-resource PUTs when rotating credentials or promoting an API between environments; GET /v1/apis/{_id}/connections shows which connections the API references before and after.
Each affected step is re-validated against the replacement connection before anything is saved, so a connection of an incompatible type (an FTP connection for an HTTP lookup, for example) fails the whole request with 422 carrying one validation error per affected step and leaves every step unchanged. A request whose _connectionId matches no step succeeds with replacedNodeCount 0. Script-mode APIs have no steps and always return 0.
API id.
6ab1f5257b3d01a908424245Request body to swap one connection for another on every export and import step of a builder-mode API. Both ids must be well-formed; the replacement connection must exist in the account and satisfy each affected step's adaptor validation.
Connection currently referenced by the API's steps. Steps that reference a different connection are left untouched.
6ab1f50179bf70c118711501Connection to reference instead. Must be usable by every matching step — an HTTP export cannot be repointed to an FTP connection, for example.
6ab1f5027c4b4e699fe872d3Matching steps now reference the new connection.
Outcome of a connection replacement on a builder-mode API.
Number of export and import steps that referenced _connectionId and were
saved with _newConnectionId. Zero means no step used the connection and
nothing changed.
1Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
PUT /v1/apis/{_id}/replaceConnection HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 90
{
"_connectionId": "6ab1f50179bf70c118711501",
"_newConnectionId": "6ab1f5027c4b4e699fe872d3"
}{
"replacedNodeCount": 1
}Executes the API once in a sandboxed test harness without invoking its public endpoint, and returns the job tree produced by the run. Use this to validate a builder-mode API's request parsing, routing, and response mapping before exposing it externally.
The response carries a metadata map keyed by step id (each value is the ordered list of stage names that ran for that step), the parent flowJob, and the per-step childJobs[]. Inspect a specific step's stages with GET /v1/apis/{_id}/test/run/{runId}/{_stepId}, where runId is the parent flowJob._id.
Test-run invocations do not surface in GET /v1/apis/{_id}/logs.
The API id.
68ae4264b5f755d2dd3796b4Optional test request for the run. When the body is empty or
omitted, the run replays the API's saved
builder.request.mockRequest.
The job tree produced by the test run.
The parent job for the test run. Its _id is the runId.
Per-step child jobs produced during the run.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.
POST /v1/apis/{_id}/test/run HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 2
{}{
"metadata": {
"68ae4264b5f755d2dd3796b4": [
"request",
"parse"
],
"main": [
"router"
]
},
"flowJob": {
"_id": "6a2e23bbcf5b64ca6b93b757",
"type": "flow",
"_integrationId": "68ed772471086fb1a76686de",
"status": "completed",
"numError": 1,
"numSuccess": 1,
"startedAt": "2026-06-14T03:44:59.577Z",
"endedAt": "2026-06-14T03:44:59.947Z"
},
"childJobs": [
{
"_id": "6a2e23bbcf5b64ca6b93b774",
"type": "export",
"_parentJobId": "6a2e23bbcf5b64ca6b93b757",
"status": "completed",
"numSuccess": 1
}
]
}Returns the per-stage execution detail for a single step of a completed API test run. runId is the parent flowJob._id returned by POST /v1/apis/{_id}/test/run, and _stepId is the step id surfaced in that run's metadata map.
Each entry in stages[] carries the stage name (e.g. request, parse, router) plus its input, output, and errors. Stages that did not produce data for a given direction return null for that field. Top-level errors aggregates step-level errors.
The API id.
68ae4264b5f755d2dd3796b4The parent job id (flowJob._id) returned by the test-run request.
6a2e23bbcf5b64ca6b93b757The step id, as surfaced in the test run's metadata map.
68ae4264b5f755d2dd3796b4Per-stage execution detail for the requested step.
Aggregated step-level errors.
Bad request. The server could not understand the request because of malformed syntax or invalid parameters.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id}/test/run/{runId}/{_stepId} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"stages": [
{
"name": "request",
"errors": null,
"output": null,
"input": [
{
"record": {
"page": {
"_userId": "624cb0346309dc3a543733a2",
"data": [
{}
]
}
},
"errors": [],
"traceKey": null
}
]
},
{
"name": "parse",
"errors": null,
"input": null,
"output": [
{
"record": {},
"errors": [],
"traceKey": null
}
]
}
],
"errors": []
}Get request/response captures for an API test-run step
Returns the request/response captures recorded for a single export or import step of an API test run. runId is the parent flowJob._id from POST /v1/apis/{_id}/test/run, and _stepId is the step id from that run's metadata map.
Each entry in requests[] is a summary identified by an opaque key; fetch the full decoded request/response envelope with GET /v1/apis/{_id}/{_stepId}/requests/{key}. A step id that is not an export or import (such as a router) returns a 400 invalid_ref, and a step that captured no request/response data returns a 404 req_res_logs_not_found.
The API id.
68ae4264b5f755d2dd3796b4The parent job id (flowJob._id) returned by the test-run request.
6a2e23bbcf5b64ca6b93b757The step id, as surfaced in the test run's metadata map. Must be an export or import step.
68ae434d5fcd3b761b24253aRequest captures recorded for the step.
The _stepId does not resolve to an export or import step (for example, a router step
or a malformed id). Use a step id that ran an outbound request.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
No request/response data is stored for the requested step — it captured nothing, or the run/step id didn't resolve.
GET /v1/apis/{_id}/test/run/{runId}/{_stepId}/logs/requestAndResponse HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"requests": [
{
"key": "5475338577473-6c43f93c1fa84b248d64e0d7be1f275f-200-undefined-import-testMode",
"time": 1782779822527,
"method": "undefined",
"statusCode": "200",
"stage": "import"
}
]
}Returns the set of requests captured for a single step of an API. _stepId identifies the step within the API's configuration. Each entry in requests[] is a captured request summary; follow up with GET /v1/apis/{_id}/{_stepId}/requests/{key} to retrieve one entry in full.
An empty requests[] simply means nothing is currently stored for this step.
The API id.
68ae4264b5f755d2dd3796b4The step id within the API's configuration.
68ae4264b5f755d2dd3796b4Captured requests for the step. requests[] is empty when nothing is stored.
Captured request entries for this step.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id}/{_stepId}/requests HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"requests": []
}Returns the full captured request/response envelope for one entry of an API step, looked up by the opaque key values surfaced in GET /v1/apis/{_id}/{_stepId}/requests. Matches the exact entry whose key is provided — there is no partial-match query on this endpoint.
Use the key exactly as returned by the parent listing; do not construct one manually. A 404 means the key has expired from retention or was never captured.
The API id.
68ae4264b5f755d2dd3796b4The step id within the API's configuration.
68ae4264b5f755d2dd3796b4Opaque request key from the parent GET /v1/apis/{_id}/{_stepId}/requests listing. Use the
key exactly as returned; do not construct one manually.
5481201053696-a10af1ade8fe477a847771c1e3716e36-200-POSTThe full captured request/response envelope for the entry.
Decoded request/response envelope for the captured entry.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
GET /v1/apis/{_id}/{_stepId}/requests/{key} HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"time": 1776917346304,
"request": {
"method": "POST",
"url": "/apis/v1/orders",
"headers": {
"content-type": "application/json"
},
"body": "{\"orderId\":\"SO-1042\"}"
},
"response": {
"statusCode": 200,
"headers": {
"content-type": "application/json"
},
"body": "{\"orderId\":\"SO-1042\"}"
},
"key": "5481201053696-a10af1ade8fe477a847771c1e3716e36-200-POST"
}Clones a builder-mode API along with the resources it depends on (such as its backing import) and returns a manifest of every resource created.
The request body is required: version must be supplied, and the cloned API's combination of version, method, and relativeURI must be unique. Reusing all three returns a 422 clone_api_already_exists. Pass _integrationId to create the clone inside an integration — when omitted, the clone is created standalone rather than inheriting the source API's integration. Add _apiGroupingId to file the clone under one of that integration's apiGroupings.
Only builder-type APIs can be cloned — cloning any other API type returns a 400 clone_not_supported.
To check for a version/method/relativeURI conflict without creating anything, call POST /v1/apis/{_id}/clone/validate first.
The id of the API to clone.
68ae4264b5f755d2dd3796b4Version identifier for the cloned API. The cloned API's combination of
version, method, and relativeURI must be unique — reusing all three
returns a 422 clone_api_already_exists.
v2Name for the cloned API. Defaults to a copy of the source API's name when omitted.
IDP (v2)Integration the cloned API is created in. When omitted, the clone is created standalone — it does not inherit the source API's integration.
6a429af50547257e3301246cGrouping inside the target integration that the clone is filed under; null
or omitted leaves it ungrouped. Honored only together with _integrationId —
sent without it, the clone is created standalone and the grouping is dropped
silently. A grouping that belongs to a different integration fails the clone
with 422 apigrouping_not_belong and nothing is created.
60a1b2c3d4e5f60012345678The clone was created. Returns a manifest of every resource the clone created — the new API plus any dependencies it copied (imports, scripts).
Manifest of resources created by the clone.
Model name of the created resource (e.g. Api, Import).
ApiUnique id of the created resource.
6a2e23bbcf5b64ca6b93b757The request was rejected. Common causes: the body omits the required version
field (required_field_missing), or the target API is not a builder-type API
(clone_not_supported — only builder APIs can be cloned).
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
Not found. The requested resource does not exist or is not visible to the caller.
An API with the same version, method, and relativeURI already exists — clone
with a different version (or change the method/URI) to create a distinct API — or
_apiGroupingId is not one of the target integration's apiGroupings.
POST /v1/apis/{_id}/clone HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 34
{
"version": "v2",
"name": "IDP (v2)"
}[
{
"model": "Import",
"_id": "6a2e23bbcf5b64ca6b93b73d"
},
{
"model": "Api",
"_id": "6a2e23bbcf5b64ca6b93b757"
}
]Dry-run check for POST /v1/apis/{_id}/clone. Verifies that cloning the API to the target version would not collide with an existing API route — the clone keeps the source API's method and relativeURI, so the target version + method + relativeURI combination must not conflict with an API that is already registered in the account. Nothing is created or modified.
Returns canClone: true when the route is free, false when it conflicts — pick a different version before calling POST /v1/apis/{_id}/clone. Only builder-type APIs can be validated; a script-type API returns 404, the same as an unknown id.
The id of the API to validate cloning for.
68ae4264b5f755d2dd3796b4Version identifier the clone would be created under. Omitting
it returns a 400 required_field_missing.
v2Validation result. Returned for both outcomes — check canClone.
When true, the target version + method + relativeURI
route is free and the clone can be created. When false, the
route conflicts with an existing API — choose a different
version.
The body omits the required version field.
Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
The API does not exist, is not visible to the caller, or is not a builder-type API.
POST /v1/apis/{_id}/clone/validate HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 16
{
"version": "v2"
}{
"canClone": true
}Packages a builder-mode API as an installable template and returns a signed S3 URL where the template .zip can be downloaded. The URL is pre-signed and short-lived (approximately 15 minutes), so fetch the file promptly; call the endpoint again for a fresh URL.
The .zip contains the API definition plus every resource it references — imports, exports, connections, and scripts — grouped into one folder per resource type, with an integration.json manifest at the root.
Only builder-type APIs can be exported — requesting a script-type API returns 404, the same as an unknown id. Requires the create:api:template permission.
The id of the API to export.
68ae4264b5f755d2dd3796b4Signed download URL for the API template zip.
Pre-signed, short-lived S3 URL to download the template .zip.
https://integrator-templates.s3.us-east-1.amazonaws.com/68ae4264b5f755d2dd3796b4.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Signature=b117bf598b5535ed024cdbdfec756172f386fd39ad4e4536e40e5efbbf4ff52aS3 object key for the generated template .zip, named <apiId>.zip.
68ae4264b5f755d2dd3796b4.zipUnauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.
Note: the 401 response is produced by the auth middleware before the
request reaches the endpoint handler, so it does not follow the
standard {errors: [...]} envelope. Instead the body is a bare
{message: string} object with no code, no errors array. Callers
handling 401s should key off the HTTP status and the message string,
not try to destructure an errors[].
The API does not exist, is not visible to the caller, or is not a builder-type API (script-type APIs cannot be exported as templates).
GET /v1/apis/{_id}/template HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"signedURL": "https://integrator-templates.s3.us-east-1.amazonaws.com/68ae4264b5f755d2dd3796b4.zip?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Signature=b117bf598b5535ed024cdbdfec756172f386fd39ad4e4536e40e5efbbf4ff52a",
"key": "68ae4264b5f755d2dd3796b4.zip"
}Last updated
Was this helpful?